A critical use after free vulnerability in Google Android 15 permits an unauthenticated attacker to achieve local privilege escalation without requiring user interaction.

This is a use after free flaw occurring in multiple system locations, which allows an attacker to execute arbitrary code. The vulnerability requires no additional execution privileges and no user interaction to trigger, facilitating local elevation of privilege.

Successful exploitation of this vulnerability allows an attacker to gain elevated privileges on the target device, potentially leading to a full system compromise. With a CVSS score of 8.4, this flaw represents a high risk to data confidentiality, integrity, and system availability. Unauthorized access at this level could result in the exfiltration of sensitive user data or the installation of persistent malicious software.

Immediate Action: Apply the official Android security updates provided by Google in the March 2025 bulletin to address the underlying memory management defect.

Proactive Monitoring: Monitor device system logs for unusual crashes or unexpected process terminations that may indicate attempted memory corruption or exploitation.

Compensating Controls: Ensure that all security patches are deployed through the device management system and restrict physical access to devices to prevent unauthorized local interaction.

Public Exploit Available: No (exploit_available: false)

Given the potential for local privilege escalation and the high CVSS severity rating, organizations should prioritize the deployment of the March 2025 security update for all Android 15 devices. Failure to patch this vulnerability leaves endpoints susceptible to full compromise by any entity with local access to the hardware.